topic Re: Active directory groups in QlikView

Active directory groups

denis115 — Wed, 25 Nov 2020 16:16:04 GMT

Hi everyone!

I need to know if it is possible to hide sheet from AD groups?

I have 3 users and 3 groups and what I want is :

user1 (from ad group Q1) =sheet 1

user2 (from ad group Q2)=sheet 2

user3 (from ad group Q3)=sheet3

thank you!

Re: Active directory groups

stabben23 — Fri, 06 Apr 2018 08:48:08 GMT

Hi,

are you using Publisher to distribute the document to a specific AD-Group or do you use Section Access currently?

In Your case if you only have 3 users there is no win to use the AD-Groups, you can easy use the AD-username instead.

When I try to do something simular, this dosent work when I used Publisher. Because if you Distribute the document to an AD-Group then the user Access the document With this AD-Group. When later user has opened the document he should then be a part of another AD-Group, ex Q1. I'll dont think qlikview recognize this 3 Groups after it has been Distributed to an other AD-Group.

Re: Active directory groups

denis115 — Fri, 06 Apr 2018 09:14:12 GMT

There are more users of course. Im using section access and here groups are working fine but when I use groups in hidding sheet like this

If(Match(NTNAME(),'DOMAIN\GROUP'),1,0)

it doesnt work

Re: Active directory groups

stabben23 — Fri, 06 Apr 2018 09:32:45 GMT

Ok, how does Your Section Access Looks like?

Have you create a table where you have specify what sheet Sub Ad-Group should have Access to?

Re: Active directory groups

stabben23 — Fri, 06 Apr 2018 09:39:20 GMT

What is NTNAME() by the way? OSUser() should be used if you want to use AD-user.

Re: Active directory groups

denis115 — Fri, 06 Apr 2018 09:50:58 GMT

I need not user but the group

Re: Active directory groups

denis115 — Fri, 06 Apr 2018 09:52:30 GMT

it was my second variant to do but it will take a lot of time because I have more then 10 sheets

Re: Active directory groups

stabben23 — Fri, 06 Apr 2018 10:00:57 GMT

You cant use AD-Groups directly in Section Access, you must get Down to user Level to get it to work.

marcus_sommer‌ pcammaert‌

Re: Active directory groups

denis115 — Fri, 06 Apr 2018 10:27:26 GMT

yes I can use cause it and it work very good and with no errors

ex:

Section Access;
LOAD * INLINE

[

ACCESS, NTNAME,PRODTYPE,PRODTYPE3,REGION1

ADMIN, DOMAIN\QlikView,*,*,*

];

Section Application;

Re: Active directory groups

stabben23 — Fri, 06 Apr 2018 10:32:16 GMT

Yes You could use it as a first reduction, but then you want to use New Groups on sheets. I'll think that wont work on Group Level.

Re: Active directory groups

denis115 — Fri, 06 Apr 2018 10:38:17 GMT

does it mean that there is no way to hide sheet from ad-group?

Re: Active directory groups

marcus_sommer — Fri, 06 Apr 2018 10:48:29 GMT

I agree with Staffan - section access accepts active directory groups as well as users but osuser() will always return the username and could therefore not be used to control anything on a group-level. Here are various examples how it could be implemented:

Sheets Security with Section Access

Sheets Security with Section Access File

Section Access - Hide Sheet Level

Chart Level Access by user

Sheet level access

Beside this the sheet-control is without further measures which successfully prevents the creation of new objects or changing existent ones only a special kind of usability and not a real secure approach. Therefore I suggest to reduce the data, too.

- Marcus

Re: Active directory groups

stabben23 — Fri, 06 Apr 2018 10:50:35 GMT

I'll think you in some way have to create a list with all users one by one and therefore looses the opportunity to use Groups. I could be wrong, but havent found anything in the community With this kind of solution.

bbt‌ mybe knows more about this

Re: Active directory groups

denis115 — Fri, 06 Apr 2018 10:58:10 GMT

in each ad-group is only one persone , it was made because if a persone go from job and in his place come another persone the username will be changed but group will remain

Re: Active directory groups

stabben23 — Fri, 06 Apr 2018 11:04:55 GMT

Yes, thats why Groups in AD are used, but in this case it doesnt helps. I have earlier read directly from AD-database and create lists With all users and also flagged them who should have Access to what.

You can save this in a qvd and use it as Section Access, this will be on userlevel, but it will reflect the changes in AD-database, ex if someone quit hes job.

Have a look here

Section Access (Data Reduction) using Active Directory

Re: Active directory groups

Bill_Britt — Fri, 06 Apr 2018 13:03:20 GMT

Hi,

I stole this code from another post and made changes. In the below TESTA is a group and the code does work.

SECURITY:

LOAD * INLINE [

ACCESS, NTNAME, USER, COUNTRY

ADMIN, ADMINISTRATOR, *,*

USER, USER1, USER1, MEXICO

USER, TESTA, TESTA, USA

];

Section Application;

/* CHANGE THE NTNAME AND USER VALUES TO REFLECT YOUR OWN USERS */

SHEET_ACCESS:

LOAD * INLINE [

USER, SHEET1, SHEET2

USER1, 1, 0

TESTA, 0, 1

];

Re: Active directory groups

denis115 — Wed, 11 Apr 2018 06:35:07 GMT

sheet 1 and sheet 2 are LIST ID?

Re: Active directory groups

stabben23 — Wed, 11 Apr 2018 07:32:20 GMT

No those are just fictitious Field name. Have a look here page1 and page 2 for a better understanding.

Section Access - Hide Sheet Level